A front "gateway" rule denies the exact, case-sensitive path /m02-p/naked/path-bypass/admin (try it - 403). The rule and the app disagree on normalisation. One clean bypass: a path variant the exact-match deny rule missed - a different case (/Admin) or a trailing slash (/admin/) reaches the very same console.